| # This is the Minder profile file used for securely monitoring rdimitrov/go-tuf-metadata. |
| # For more information, see https://github.com/stacklok/minder. |
| --- |
| version: v1 |
| type: profile |
| name: go-tuf-metadata |
| context: |
| provider: github |
| alert: "on" |
| remediate: "on" |
| repository: |
| - type: secret_scanning |
| def: |
| enabled: true |
| - type: secret_push_protection |
| def: |
| enabled: true |
| - type: github_actions_allowed |
| def: |
| allowed_actions: all |
| # - type: allowed_selected_actions |
| # def: |
| # github_owned_allowed: true |
| # verified_allowed: true |
| # patterns_allowed: [] |
| - type: default_workflow_permissions |
| def: |
| default_workflow_permissions: write |
| can_approve_pull_request_reviews: true |
| - type: codeql_enabled |
| def: |
| languages: [go] |
| schedule_interval: '30 4-6 * * *' |
| - type: actions_check_pinned_tags |
| def: {} |
| - type: dependabot_configured |
| def: |
| package_ecosystem: gomod |
| schedule_interval: weekly |
| apply_if_file: go.mod |
| - type: dockerfile_no_latest_tag |
| def: {} |
| # - type: trivy_action_enabled |
| # def: {} |
| - type: branch_protection_enabled |
| params: |
| branch: main |
| def: {} |
| - type: branch_protection_allow_deletions |
| params: |
| branch: main |
| def: |
| allow_deletions: false |
| - type: branch_protection_allow_force_pushes |
| params: |
| branch: main |
| def: |
| allow_force_pushes: true |
| # - type: branch_protection_enforce_admins |
| # params: |
| # branch: main |
| # def: |
| # enforce_admins: true |
| - type: branch_protection_lock_branch |
| params: |
| branch: main |
| def: |
| lock_branch: false |
| - type: branch_protection_require_conversation_resolution |
| params: |
| branch: main |
| def: |
| required_conversation_resolution: true |
| - type: branch_protection_require_linear_history |
| params: |
| branch: main |
| def: |
| required_linear_history: true |
| - type: branch_protection_require_pull_request_approving_review_count |
| params: |
| branch: main |
| def: |
| required_approving_review_count: 1 |
| - type: branch_protection_require_pull_request_code_owners_review |
| params: |
| branch: main |
| def: |
| require_code_owner_reviews: true |
| - type: branch_protection_require_pull_request_dismiss_stale_reviews |
| params: |
| branch: main |
| def: |
| dismiss_stale_reviews: true |
| - type: branch_protection_require_pull_request_last_push_approval |
| params: |
| branch: main |
| def: |
| require_last_push_approval: true |
| - type: branch_protection_require_pull_requests |
| params: |
| branch: main |
| def: |
| required_pull_request_reviews: true |
| - type: branch_protection_require_signatures |
| params: |
| branch: main |
| def: |
| required_signatures: false |
| - type: license |
| def: |
| license_filename: LICENSE |
| license_type: "Apache License" |
| # artifact: |
| # - type: artifact_signature |
| # params: |
| # tags: [main] |
| # name: test |
| # def: |
| # is_signed: true |
| # is_verified: true |
| # is_bundle_verified: true |
| pull_request: |
| - type: pr_vulnerability_check |
| def: |
| action: review |
| ecosystem_config: |
| - name: go |
| vulnerability_database_type: osv |
| vulnerability_database_endpoint: https://vuln.go.dev |
| package_repository: |
| url: https://proxy.golang.org |
| sum_repository: |
| url: https://sum.golang.org |